docs: def validate_ticket(self, ticket, service, renew=False, require_https=False):
          """
          Given a ticket string and service identifier, validate the
          corresponding ``Ticket``. If validation succeeds, return the
          ``Ticket``. If validation fails, raise an appropriate error.
  
          If ``renew`` is ``True``, ``ServiceTicket`` validation will
          only succeed if the ticket was issued from the presentation
          of the user's primary credentials.
  
          If ``require_https`` is ``True``, ``ServiceTicket`` validation
          will only succeed if the service URL scheme is HTTPS.
          """
          if not ticket:
              raise InvalidRequest("No ticket string provided")
  
          if not self.model.TICKET_RE.match(ticket):
              raise InvalidTicket("Ticket string %s is invalid" % ticket)
  
          try:
              t = self.get(ticket=ticket)
          except self.model.DoesNotExist:
              raise InvalidTicket("Ticket %s does not exist" % ticket)
  
          if t.is_consumed():
              raise InvalidTicket("%s %s has already been used" %
                                  (t.name, ticket))
          if t.is_expired():
              raise InvalidTicket("%s %s has expired" % (t.name, ticket))
  
          if not service:
              raise InvalidRequest("No service identifier provided")
  
          if require_https and not is_scheme_https(service):
              raise InvalidService("Service %s is not HTTPS" % service)
  
          if not service_allowed(service):
              raise InvalidService("Service %s is not a valid %s URL" %
                                   (service, t.name))
  
          try:
              if not match_service(t.service, service):
                  raise InvalidService("%s %s for service %s is invalid for "
                          "service %s" % (t.name, ticket, t.service, service))
          except AttributeError:
              pass
  
          try:
              if renew and not t.is_primary():
                  raise InvalidTicket("%s %s was not issued via primary "
                                      "credentials" % (t.name, ticket))
          except AttributeError:
              pass
  
          logger.debug("Validated %s %s" % (t.name, ticket))
          return t